Amlogic Android SDK: pppoe_wrapper root command injection (CVE-2026-119737)
A command injection vulnerability in the pppoe_wrapper daemon on Amlogic-based Android TV boxes allows local attackers to achieve root privilege escalation by sending malicious payloads to a world-writable AF_UNIX socket.
CVE search metadata
CVE search record: CVE-2026-119737. Severity: high. CVSS: 7.8. KEV: no. Product: Android SDK, A95X. Brief: Amlogic Android SDK: pppoe_wrapper root command injection (CVE-2026-119737). Brief link: https://feed.craftedsignal.io/briefs/2026-11-amlogic-pppoe-wrapper/
Triage facts
Revision 1- Applicability
- Android SDK, A95X
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 21:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The pppoe_wrapper vendor daemon within the Amlogic Android SDK, utilized in devices such as the Nexbox A95X (Amlogic S905/S905X), is vulnerable to command injection. An attacker with local access can interact with a world-writable AF_UNIX datagram socket located at /dev/socket/pppoe_wrapper. By crafting a message starting with 'pppd pty' followed by shell metacharacters, the input is passed to system(3) and executed with root privileges via /system/bin/sh -c. This results in full system compromise. No patch information is currently provided.
Impact
Successful exploitation results in full root privilege escalation on the affected Android device.
Recommendation
Identify and audit devices running the Amlogic Android SDK for the presence of the world-writable /dev/socket/pppoe_wrapper socket. If the service is not required for production functionality, disable the pppoe_wrapper daemon or restrict access permissions to the socket file if the underlying operating system and hardware configuration permit.
Immediate actions
Audit environment for the existence of /dev/socket/pppoe_wrapper
Threat Hunt
Monitor for suspicious processes spawned by the pppoe_wrapper process or unexpected root shells
Data: Auditd or process accounting logs identifying pppoe_wrapper as the parent process